CVE-2020-36561: 
NixOS vulnerability analysis and mitigation

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory in github.com/yi-ge/unzip before version 1.0.3-0.20200308084313-2adbaa4891b9 (GO Vuln DB).

The vulnerability exists when extraction code omits validation on the file paths in the archive. When processing archive files, the code concatenates the target directory with the file name from the archive without proper validation, allowing directory traversal through specially crafted filenames containing '../' sequences. This can lead to files being written outside the intended target directory (Snyk Research).

This vulnerability allows attackers to write or overwrite arbitrary files outside of the intended target directory. This can potentially lead to remote command execution if executable files are overwritten, or cause damage by overwriting configuration files and other sensitive resources. The vulnerability can be exploited on both client machines and servers (Snyk Research).

The vulnerability was fixed in version 1.0.3-0.20200308084313-2adbaa4891b9 by adding proper path sanitization. The fix includes checking if the final path after joining with the destination directory starts with the cleaned destination directory path plus a path separator, preventing directory traversal attempts (GitHub Commit).